Click2Shell: WordPress Flaw Enables RCE Chain

Click2Shell is a WordPress Core vulnerability that can force the installation and preview of a theme via a crafted URL; when combined with insecure third‑party themes that execute code during previews or expose unauthenticated AJAX handlers, the chain can lead to remote PHP execution. WordPress released security updates (7.1.1 and backported fixes) on Sept 17, a PoC was published shortly after, researchers rated the standalone issue CVSS 7.1 and the full exploit chain CVSS 9.3, and the report advises immediate core updates, auditing themes (including inactive ones), and hunting for anomalous theme/plugin activity.